/[RomCheater]/trunk/Win32/Sojaner.MemoryScanner/MemoryScanner.cs
ViewVC logotype

Contents of /trunk/Win32/Sojaner.MemoryScanner/MemoryScanner.cs

Parent Directory Parent Directory | Revision Log Revision Log


Revision 812 - (show annotations) (download)
Tue Apr 15 14:52:10 2014 UTC (5 years, 9 months ago) by william
File size: 35684 byte(s)
+ update logging to use Enterpise.Logging -- more work is still needed

1 #region Logging Defines
2 // include this any class or method that required logging, and comment-out what is not needed
3
4 #region Enabled logging levels
5 #define LOGGING_ENABLE_INFO
6 #define LOGGING_ENABLE_WARN
7 #define LOGGING_ENABLE_DEBUG
8 #define LOGGING_ENABLE_VERBOSEDEBUG
9 #define LOGGING_ENABLE_ERROR
10 #define LOGGING_ENABLE_VERBOSEERROR
11 //#define LOGGING_ENABLE_PROFILER
12 #endregion
13 #endregion
14 using System;
15 using System.Collections.Generic;
16 using System.Text;
17 using System.Diagnostics;
18 using System.Threading;
19 using System.Runtime.InteropServices;
20 using RomCheater.Logging;
21 using System.IO;
22 using Sojaner.MemoryScanner.MemoryProviers;
23 using Microsoft.Win32.SafeHandles;
24 using Microsoft.Win32.Interop;
25 using System.ComponentModel;
26 using ManagedWinapi;
27 using RomCheater.PluginFramework.Events;
28 using RomCheater.Core;
29 using Enterprise.Logging;
30
31 namespace Sojaner.MemoryScanner
32 {
33 // code borrowed from: http://www.codeproject.com/KB/cs/sojaner_memory_scanner.aspx
34 #region ProcessMemoryReader class
35 //Thanks goes to Arik Poznanski for P/Invokes and methods needed to read and write the Memory
36 //For more information refer to "Minesweeper, Behind the scenes" article by Arik Poznanski at Codeproject.com
37 internal class ProcessMemoryReader : IMemoryReader, IMemoryWriter, IFileWriter, IPatchMemory,IReadMemory, IAcceptsBytesReadEvent
38 {
39 // constants information can be found in <winnt.h>
40 [Flags]
41 enum ProcessAccessFlags : uint
42 {
43 All = 0x001F0FFF,
44 Terminate = 0x00000001,
45 CreateThread = 0x00000002,
46 VMOperation = 0x00000008,
47 VMRead = 0x00000010,
48 VMWrite = 0x00000020,
49 DupHandle = 0x00000040,
50 SetInformation = 0x00000200,
51 QueryInformation = 0x00000400,
52 Synchronize = 0x00100000
53 }
54 [Flags]
55 public enum AllocationProtect : uint
56 {
57 // http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspx
58 NONE = 0,
59 PAGE_NOACCESS = 0x00000001,
60 PAGE_READONLY = 0x00000002,
61 PAGE_READWRITE = 0x00000004,
62 PAGE_WRITECOPY = 0x00000008,
63 PAGE_EXECUTE = 0x00000010,
64 PAGE_EXECUTE_READ = 0x00000020,
65 PAGE_EXECUTE_READWRITE = 0x00000040,
66 PAGE_EXECUTE_WRITECOPY = 0x00000080,
67 PAGE_GUARD = 0x00000100,
68 PAGE_NOCACHE = 0x00000200,
69 PAGE_WRITECOMBINE = 0x00000400
70 }
71 [StructLayout(LayoutKind.Sequential)]
72 public struct MEMORY_BASIC_INFORMATION
73 {
74 public IntPtr BaseAddress;
75 public IntPtr AllocationBase;
76 public AllocationProtect AllocationProtect;
77 public IntPtr RegionSize;
78 public uint State;
79 public uint Protect;
80 public uint Type;
81 }
82
83 public ProcessMemoryReader()
84 {
85 }
86 public event BaseEventHandler<OnBytesReadEventArgs> OnBytesRead;
87 /// <summary>
88 /// Process from which to read
89 /// </summary>
90 public Process ReadProcess
91 {
92 get
93 {
94 return m_ReadProcess;
95 }
96 set
97 {
98 m_ReadProcess = value;
99 }
100 }
101
102 private Process m_ReadProcess = null;
103
104 //SafeWaitHandle handle;
105 //private IntPtr handle = IntPtr.Zero;
106 //SafeWaitHandle m_hProcess; /* unused */
107 //public void OpenProcess()
108 //{
109 // try
110 // {
111 // // m_hProcess = ProcessMemoryReaderApi.OpenProcess(ProcessMemoryReaderApi.PROCESS_VM_READ, 1, (uint)m_ReadProcess.Id);
112 // //if (!TokenAdjuster.AdjustProcessTokenPrivileges("SeDebugPrivilege"))
113 // //{
114 // // logger.Warn.WriteLine("Failed to set SeDebugPrivilege on current process");
115 // //}
116 // ProcessAccessFlags access;
117 // access = ProcessAccessFlags.VMRead
118 // | ProcessAccessFlags.VMWrite
119 // | ProcessAccessFlags.VMOperation;
120 // //m_hProcess = ProcessMemoryReaderApi.OpenProcess((uint)access, 1, (uint)m_ReadProcess.Id);
121 // handle = ProcessMemoryReaderApi.OpenProcess(access, true, m_ReadProcess.Id);
122 // //m_hProcess = new SafeWaitHandle(handle, false);
123 // }
124 // catch (SEHException ex)
125 // {
126 // logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
127 // logger.Error.WriteLine(ex.ToString());
128 // throw ex;
129 // }
130 // catch (Exception ex)
131 // {
132 // logger.Error.WriteLine(ex.ToString());
133 // throw ex;
134 // }
135 //}
136
137 //public void CloseHandle()
138 //{
139 // try
140 // {
141 // ////if (handle.IsInvalid) { return; }
142 // ////if (handle.IsClosed) { return; }
143 // //m_hProcess.Close();
144 // //m_hProcess.Dispose();
145 // //m_hProcess = null;
146 // //handle = IntPtr.Zero;
147 // //m_ReadProcess = null;
148 // //string stack_trace = System.Environment.StackTrace;
149 // int iRetValue;
150 // iRetValue = ProcessMemoryReaderApi.CloseHandle(handle);
151 // handle = IntPtr.Zero;
152 // ReadProcess = null;
153 // if (iRetValue == 0)
154 // {
155 // throw new Exception("CloseHandle failed");
156 // }
157 // }
158 // catch (SEHException ex)
159 // {
160 // logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
161 // logger.Error.WriteLine(ex.ToString());
162 // throw ex;
163 // }
164 // catch (Exception ex)
165 // {
166 // logger.Error.WriteLine(ex.ToString());
167 // throw ex;
168 // }
169 //}
170 ///// <summary>
171 ///// ProcessMemoryReader is a class that enables direct reading a process memory
172 ///// </summary>
173 //private class ProcessMemoryReaderApi
174 ////{
175 //[DllImport("kernel32.dll")]
176 //public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);
177
178 // // function declarations are found in the MSDN and in <winbase.h>
179
180 // // HANDLE OpenProcess(
181 // // DWORD dwDesiredAccess, // access flag
182 // // BOOL bInheritHandle, // handle inheritance option
183 // // DWORD dwProcessId // process identifier
184 // // );
185 // [DllImport("kernel32.dll")]
186 // public static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);
187
188 // // BOOL CloseHandle(
189 // // HANDLE hObject // handle to object
190 // // );
191 // [DllImport("kernel32.dll")]
192 // public static extern Int32 CloseHandle(IntPtr hObject);
193
194 // // BOOL ReadProcessMemory(
195 // // HANDLE hProcess, // handle to the process
196 // // LPCVOID lpBaseAddress, // base of memory area
197 // // LPVOID lpBuffer, // data buffer
198 // // SIZE_T nSize, // number of bytes to read
199 // // SIZE_T * lpNumberOfBytesRead // number of bytes read
200 // // );
201 // [DllImport("kernel32.dll", SetLastError = true)]
202 // public static extern bool ReadProcessMemory(
203 // IntPtr hProcess,
204 // IntPtr lpBaseAddress,
205 // [Out] byte[] lpBuffer,
206 // uint dwSize,
207 // out int lpNumberOfBytesRead
208 // );
209
210 // // BOOL WriteProcessMemory(
211 // // HANDLE hProcess, // handle to process
212 // // LPVOID lpBaseAddress, // base of memory area
213 // // LPCVOID lpBuffer, // data buffer
214 // // SIZE_T nSize, // count of bytes to write
215 // // SIZE_T * lpNumberOfBytesWritten // count of bytes written
216 // // );
217 // [DllImport("kernel32.dll", SetLastError = true)]
218 // public static extern bool WriteProcessMemory(
219 // IntPtr hProcess,
220 // IntPtr lpBaseAddress,
221 // byte[] lpBuffer,
222 // uint nSize,
223 // out UIntPtr lpNumberOfBytesWritten);
224
225
226 //}
227
228 #region IMemoryReader Members
229 #region public bool ReadFirstNonZeroByte(uint MemoryAddress, uint bytesToRead, out int address)
230 public bool ReadFirstNonZeroByte(ulong MemoryAddress, ulong bytesToRead, out ulong address)
231 {
232 //logger.Info.WriteLine("Dumping memory (0x{0:x8}-0x{1:x8}) from pid=({2})", MemoryAddress, MemoryAddress + bytesToRead, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
233 address = 0;
234 uint byte_alignment = 1;
235 // get common init parameters
236 //InitMemoryDump(out byte_alignment);
237 ulong mem_address = MemoryAddress;
238 ulong _bytesToRead = bytesToRead;
239 byte[] buffer = new byte[] { };
240 try
241 {
242 //using (MemoryStream ms = new MemoryStream())
243 //{
244 // //BinaryWriter bw = new BinaryWriter(ms);
245 // //foreach (byte b in data) { bw.Write(b); }
246 for (ulong i = 0; i <= bytesToRead; )
247 {
248 if (_bytesToRead < byte_alignment)
249 {
250 _bytesToRead = bytesToRead;
251 buffer = new byte[_bytesToRead];
252 }
253 else
254 {
255 _bytesToRead = byte_alignment;
256 buffer = new byte[byte_alignment];
257 }
258 ulong bytesRead = 0;
259 ReadProcessMemory(mem_address, _bytesToRead, out bytesRead, out buffer);
260 if (buffer.Length == 0 && bytesRead == 0)
261 {
262 throw new Exception(string.Format("Failed to read memory from process: {0}", ReadProcess.ToString()));
263 }
264 //bw.Write(buffer);
265 //bw.Flush();
266 if (_bytesToRead < byte_alignment)
267 {
268 i += _bytesToRead;
269 mem_address += (ulong)_bytesToRead;
270 }
271 else
272 {
273 i += byte_alignment;
274 mem_address += (ulong)byte_alignment;
275 }
276 for (uint j = 0; j < buffer.Length; j++)
277 {
278 if (buffer[j] != 0)
279 {
280 address = mem_address;
281 break;
282 }
283 }
284 if (address != 0)
285 break;
286 }
287 // bw.Close();
288 //}
289 //logger.Info.WriteLine("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({2})", MemoryAddress, MemoryAddress + bytesToRead, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
290 return true;
291 }
292 catch (SEHException ex)
293 {
294 gLog.Error.WriteLine("ReadFirstNonZeroByte() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
295 gLog.Verbose.Error.WriteLine(ex.ToString());
296 throw ex;
297 }
298 catch (OutOfMemoryException ex)
299 {
300 gLog.Error.WriteLine("ReadFirstNonZeroByte(): OutOfMemoryException");
301 gLog.Verbose.Error.WriteLine(ex.ToString());
302 }
303 catch (Exception ex)
304 {
305 gLog.Error.WriteLine("ReadFirstNonZeroByte(): Exception");
306 gLog.Verbose.Error.WriteLine(ex.ToString());
307 throw ex;
308 }
309 return false;
310 }
311 #endregion
312
313
314 public List<MEMORY_REGION_INFORMATION> QueryMemoryRegions(ulong start, ulong size)
315 {
316 List<MEMORY_REGION_INFORMATION> regions = new List<MEMORY_REGION_INFORMATION>();
317 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)0, 0))
318 {
319 regions = mem.QueryMemoryRegions(start, size);
320 }
321 return regions;
322 }
323
324 public void UpdateAddressArray(ulong[] addresses, ulong size, out byte[][] values)
325 {
326 // size = size of data to read at each address
327 values = new byte[addresses.Length][];
328 for (int x = 0; x < values.Length; x++) { values[x] = new byte[size]; }
329
330 for (ulong i = 0; i < (ulong)addresses.Length; i++)
331 {
332 byte[] data = new byte[size];
333 ulong bytesRead = 0;
334 var address = addresses[i];
335 this.ReadProcessMemory(address, size, out bytesRead, out data);
336 values[i] = data;
337 }
338 }
339
340
341 public void ReadProcessMemoryAtOnce(ulong MemoryAddress, ulong bytesToRead, object UserState)
342 {
343 const uint size = 128;
344 //int count = 0;
345 for (ulong j = MemoryAddress; j < (MemoryAddress + bytesToRead); j += size)
346 {
347 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)j, (int)size))
348 {
349 byte[] bigMem = mem.Read();
350 //count += bigMem.Length;
351 if (this.OnBytesRead != null)
352 {
353 OnBytesReadEventArgs t = new OnBytesReadEventArgs(this, UserState, bigMem, j, bytesToRead);
354 this.OnBytesRead.Invoke(t);
355 if (t.Canceled)
356 {
357 bigMem = null;
358 break;
359 }
360
361 }
362 bigMem = null;
363 }
364 }
365 }
366 public void ReadProcessMemoryAtOnce(ulong MemoryAddress, ulong bytesToRead, out ulong bytesRead, out byte[] data)
367 {
368 Stopwatch st = new Stopwatch();
369 st.Start();
370 List<byte> buffer_list = new List<byte>();
371 const uint size = 16;
372 for (ulong j = MemoryAddress; j < (MemoryAddress + bytesToRead); j += size)
373 {
374 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)j, (int)size))
375 {
376 byte[] bigMem = mem.Read();
377 foreach (byte b in bigMem) { buffer_list.Add(b); }
378 bigMem = null;
379 }
380 }
381 bytesRead = (ulong)buffer_list.Count;
382 data = new byte[bytesToRead];
383 data.Initialize();
384 Buffer.BlockCopy(buffer_list.ToArray(), 0, data, 0, (int)bytesToRead);
385 st.Stop();
386 gLog.Profiler.WriteLine("ReadProcessMemoryAtOnce(): start=0x{0:x8} end=0x{1:x8} took {2:0.0000} seconds", MemoryAddress, MemoryAddress + bytesToRead, st.Elapsed.TotalSeconds);
387 }
388 #region public void ReadProcessMemory(int MemoryAddress, uint bytesToRead, out int bytesRead, out byte[] data)
389 public void ReadProcessMemory(long MemoryAddress, long bytesToRead, out ulong bytesRead, out byte[] data)
390 {
391 ReadProcessMemory((ulong)MemoryAddress, (ulong)bytesToRead, out bytesRead, out data);
392 }
393 public void ReadProcessMemory(ulong MemoryAddress, ulong bytesToRead, out ulong bytesRead, out byte[] data)
394 {
395 try
396 {
397 ReadProcessMemoryAtOnce(MemoryAddress, bytesToRead, out bytesRead, out data);
398 }
399 catch (SEHException ex)
400 {
401 gLog.Error.WriteLine("ReadProcessMemory() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
402 gLog.Verbose.Error.WriteLine(ex.ToString());
403 throw ex;
404 }
405 catch (Exception ex)
406 {
407 gLog.Error.WriteLine("ReadProcessMemory(): Exception");
408 gLog.Verbose.Error.WriteLine(ex.ToString());
409 throw ex;
410 }
411 }
412 #endregion
413 #endregion
414
415 #region IMemoryWriter Members
416 #region public void WriteProcessMemory(uint MemoryAddress, byte[] bytesToWrite, out int bytesWritten)
417 public void WriteProcessMemory(long MemoryAddress, byte[] bytesToWrite, out ulong bytesWritten)
418 {
419 ulong _bytesWritten = 0;
420 WriteProcessMemory((ulong)MemoryAddress, bytesToWrite, out _bytesWritten);
421 bytesWritten = (ulong)_bytesWritten;
422 }
423 public void WriteProcessMemory(ulong MemoryAddress, byte[] bytesToWrite, out ulong bytesWritten)
424 {
425 try
426 {
427 //uint _bytesWritten = 0;
428 ulong _MemoryAddress = MemoryAddress;
429
430 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)MemoryAddress, (int)bytesToWrite.Length))
431 {
432 mem.Write(0, bytesToWrite);
433 }
434 bytesWritten = (uint)bytesToWrite.Length;
435 }
436 catch (SEHException ex)
437 {
438 gLog.Error.WriteLine("WriteProcessMemory() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
439 gLog.Verbose.Error.WriteLine(ex.ToString());
440 throw ex;
441 }
442 catch (Exception ex)
443 {
444
445 gLog.Error.WriteLine("WriteProcessMemory() Exception");
446 gLog.Verbose.Error.WriteLine(ex.ToString());
447 bytesWritten = 0;
448 throw ex;
449 }
450 }
451 #endregion
452 #endregion
453
454 #region IFileWriter Members
455 #region public bool WriteProcessMemoryToFile(string filename, uint MemoryAddress, uint bytesToRead, out int bytesRead)
456 public bool WriteProcessMemoryToFile(string filename, ulong MemoryAddress, ulong bytesToRead, out ulong bytesRead)
457 {
458 //logger.Info.WriteLine("Dumping memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", MemoryAddress, MemoryAddress + bytesToRead, filename, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
459 bytesRead = 0;
460 ulong _bytesRead = 0;
461 //uint byte_alignment = 102400;
462 ulong address = MemoryAddress;
463 //ulong _bytesToRead = bytesToRead;
464 byte[] buffer = new byte[] { };
465 try
466 {
467 const ulong MEM_1KB = 1024;
468 const ulong MEM_1MB = MEM_1KB * MEM_1KB;
469 const ulong ByteChunkSize = MEM_1MB * 32;
470 FileInfo fi = new FileInfo(filename);
471 if (fi.Exists)
472 fi.Delete();
473 using (FileStream fs = new FileStream(filename, FileMode.CreateNew, FileAccess.ReadWrite, FileShare.ReadWrite))
474 {
475 using (BinaryWriter bw = new BinaryWriter(fs))
476 {
477 ulong addr = MemoryAddress;
478 for (ulong i = 0; i < bytesToRead; i += ByteChunkSize)
479 {
480 addr += i;
481 this.ReadProcessMemory(addr, ByteChunkSize, out bytesRead, out buffer);
482 if (bytesRead == ByteChunkSize)
483 {
484 _bytesRead += ByteChunkSize;
485 foreach (var b in buffer)
486 {
487 bw.Write(b);
488 }
489 }
490 else
491 {
492 throw new InvalidOperationException("Failed to read a byte from memory");
493 }
494 }
495 bw.Flush();
496 bw.Close();
497 }
498 bytesRead = _bytesRead;
499 }
500 gLog.Info.WriteLine("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", MemoryAddress, MemoryAddress + bytesToRead, filename, string.Format("0x{0:x4} {1}.exe", ReadProcess.Id, ReadProcess.ProcessName));
501 return true;
502 }
503 catch (SEHException ex)
504 {
505 gLog.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
506 gLog.Verbose.Error.WriteLine(ex.ToString());
507 throw ex;
508 }
509 catch (OutOfMemoryException ex)
510 {
511 gLog.Error.WriteLine("WriteProcessMemoryToFile(): Exception");
512 gLog.Verbose.Error.WriteLine(ex.ToString());
513 }
514 catch (Exception ex)
515 {
516 gLog.Error.WriteLine("WriteProcessMemoryToFile(): Exception");
517 gLog.Verbose.Error.WriteLine(ex.ToString());
518 throw ex;
519 }
520 return false;
521 }
522 #endregion
523 #endregion
524
525 #region IPatchMemory members
526 #region public virtual bool PatchMemory(uint address, byte value)
527 public virtual bool PatchMemory(ulong address, byte value)
528 {
529 byte[] bitData = BitConverter.GetBytes(value);
530 //UIntPtr ptrBytesWritten;
531 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
532 {
533 mem.Write(0, bitData);
534 }
535 //ProcessMemoryReaderApi.WriteProcessMemory(handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
536 //if (ptrBytesWritten.ToUInt32() == 0)
537 // return false;
538 byte check = 0;
539 ReadMemory(address, out check);
540 if (check == value) return true;
541 return false;
542 }
543 #endregion
544 #region public virtual bool PatchMemory(uint address, sbyte value)
545 public virtual bool PatchMemory(ulong address, sbyte value)
546 {
547 byte[] bitData = BitConverter.GetBytes(value);
548 //UIntPtr ptrBytesWritten;
549 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
550 {
551 mem.Write(0, bitData);
552 }
553 //ProcessMemoryReaderApi.WriteProcessMemory(handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
554 //if (ptrBytesWritten.ToUInt32() == 0)
555 // return false;
556 sbyte check = 0;
557 ReadMemory(address, out check);
558 if (check == value) return true;
559 return false;
560 }
561 #endregion
562 #region public virtual bool PatchMemory(uint address, ushort value)
563 public virtual bool PatchMemory(ulong address, ushort value)
564 {
565 byte[] bitData = BitConverter.GetBytes(value);
566 //UIntPtr ptrBytesWritten;
567 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
568 {
569 mem.Write(0, bitData);
570 }
571 //if (ptrBytesWritten.ToUInt32() == 0)
572 // return false;
573 ushort check = 0;
574 ReadMemory(address, out check);
575 if (check == value) return true;
576 return false;
577 }
578 #endregion
579 #region public virtual bool PatchMemory(uint address, short value)
580 public virtual bool PatchMemory(ulong address, short value)
581 {
582 byte[] bitData = BitConverter.GetBytes(value);
583 //UIntPtr ptrBytesWritten;
584 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
585 {
586 mem.Write(0, bitData);
587 }
588 //if (ptrBytesWritten.ToUInt32() == 0)
589 // return false;
590 short check = 0;
591 ReadMemory(address, out check);
592 if (check == value) return true;
593 return false;
594 }
595 #endregion
596 #region public virtual bool PatchMemory(uint address, uint value)
597 public virtual bool PatchMemory(ulong address, uint value)
598 {
599 byte[] bitData = BitConverter.GetBytes(value);
600 //UIntPtr ptrBytesWritten;
601 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
602 {
603 mem.Write(0, bitData);
604 }
605 //if (ptrBytesWritten.ToUInt32() == 0)
606 // return false;
607 uint check = 0;
608 ReadMemory(address, out check);
609 if (check == value) return true;
610 return false;
611 }
612 #endregion
613 #region public virtual bool PatchMemory(uint address, int value)
614 public virtual bool PatchMemory(ulong address, int value)
615 {
616 byte[] bitData = BitConverter.GetBytes(value);
617 //UIntPtr ptrBytesWritten;
618 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
619 {
620 mem.Write(0, bitData);
621 }
622 //if (ptrBytesWritten.ToUInt32() == 0)
623 // return false;
624 int check = 0;
625 ReadMemory(address, out check);
626 if (check == value) return true;
627 return false;
628 }
629 #endregion
630 #region public virtual bool PatchMemory(uint address, ulong value)
631 public virtual bool PatchMemory(ulong address, ulong value)
632 {
633 byte[] bitData = BitConverter.GetBytes(value);
634 //UIntPtr ptrBytesWritten;
635 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
636 {
637 mem.Write(0, bitData);
638 }
639 //if (ptrBytesWritten.ToUInt32() == 0)
640 // return false;
641 ulong check = 0;
642 ReadMemory(address, out check);
643 if (check == value) return true;
644 return false;
645 }
646 #endregion
647 #region public virtual bool PatchMemory(uint address, long value)
648 public virtual bool PatchMemory(ulong address, long value)
649 {
650 byte[] bitData = BitConverter.GetBytes(value);
651 //UIntPtr ptrBytesWritten;
652 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
653 {
654 mem.Write(0, bitData);
655 }
656 //if (ptrBytesWritten.ToUInt32() == 0)
657 // return false;
658 long check = 0;
659 ReadMemory(address, out check);
660 if (check == value) return true;
661 return false;
662 }
663 #endregion
664 #endregion
665
666 #region IReadMemory members
667 #region public virtual bool ReadMemory(uint address, out byte value)
668 public virtual bool ReadMemory(ulong address, out byte value)
669 {
670 value = 0;
671 try
672 {
673 //int bytesRead;
674 uint size = sizeof(byte);
675 byte[] bitData = new byte[size];
676 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
677 {
678 bitData = mem.Read(0, (int)size);
679 }
680 //if (bytesRead == 0)
681 // return false;
682 value = bitData[0];
683 return true;
684 }
685 catch
686 {
687 value = 0x00;
688 return false;
689 }
690 }
691 #endregion
692 #region public virtual bool ReadMemory(uint address, out sbyte value)
693 public virtual bool ReadMemory(ulong address, out sbyte value)
694 {
695 value = 0;
696 try
697 {
698 //int bytesRead;
699 uint size = sizeof(sbyte);
700 byte[] bitData = new byte[size];
701 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
702 {
703 bitData = mem.Read(0, (int)size);
704 }
705 //if (bytesRead == 0)
706 // return false;
707 value = Convert.ToSByte(bitData[0]);
708 return true;
709 }
710 catch
711 {
712 value = 0x00;
713 return false;
714 }
715 }
716 #endregion
717 #region public virtual bool ReadMemory(uint address, out ushort value)
718 public virtual bool ReadMemory(ulong address, out ushort value)
719 {
720 value = 0;
721 try
722 {
723 //int bytesRead;
724 uint size = sizeof(ushort);
725 byte[] bitData = new byte[size];
726 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
727 {
728 bitData = mem.Read(0, (int)size);
729 }
730 //if (bytesRead == 0)
731 // return false;
732 value = BitConverter.ToUInt16(bitData, 0);
733 return true;
734 }
735 catch
736 {
737 value = 0x00;
738 return false;
739 }
740 }
741 #endregion
742 #region public virtual bool ReadMemory(uint address, out short value)
743 public virtual bool ReadMemory(ulong address, out short value)
744 {
745 value = 0;
746 try
747 {
748 //int bytesRead;
749 uint size = sizeof(short);
750 byte[] bitData = new byte[size];
751 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
752 {
753 bitData = mem.Read(0, (int)size);
754 }
755 //if (bytesRead == 0)
756 // return false;
757 value = BitConverter.ToInt16(bitData, 0);
758 return true;
759 }
760 catch
761 {
762 value = 0x00;
763 return false;
764 }
765 }
766 #endregion
767 #region public virtual bool ReadMemory(uint address, out uint value)
768 public virtual bool ReadMemory(ulong address, out uint value)
769 {
770 value = 0;
771 try
772 {
773 //int bytesRead;
774 uint size = sizeof(uint);
775 byte[] bitData = new byte[size];
776 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
777 {
778 bitData = mem.Read(0, (int)size);
779 }
780 //if (bytesRead == 0)
781 // return false;
782 value = BitConverter.ToUInt32(bitData, 0);
783 return true;
784 }
785 catch
786 {
787 value = 0x00;
788 return false;
789 }
790 }
791 #endregion
792 #region public virtual bool ReadMemory(uint address, out int value)
793 public virtual bool ReadMemory(ulong address, out int value)
794 {
795 value = 0;
796 try
797 {
798 //int bytesRead;
799 uint size = sizeof(int);
800 byte[] bitData = new byte[size];
801 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
802 {
803 bitData = mem.Read(0, (int)size);
804 }
805 //if (bytesRead == 0)
806 // return false;
807 value = BitConverter.ToInt32(bitData, 0);
808 return true;
809 }
810 catch
811 {
812 value = 0x00;
813 return false;
814 }
815 }
816 #endregion
817 #region public virtual bool ReadMemory(uint address, out ulong value)
818 public virtual bool ReadMemory(ulong address, out ulong value)
819 {
820 value = 0;
821 try
822 {
823 //int bytesRead;
824 uint size = sizeof(ulong);
825 byte[] bitData = new byte[size];
826 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
827 {
828 bitData = mem.Read(0, (int)size);
829 }
830 //if (bytesRead == 0)
831 // return false;
832 value = BitConverter.ToUInt64(bitData, 0);
833 return true;
834 }
835 catch
836 {
837 value = 0x00;
838 return false;
839 }
840 }
841 #endregion
842 #region public virtual bool ReadMemory(uint address, out long value)
843 public virtual bool ReadMemory(ulong address, out long value)
844 {
845 value = 0;
846 try
847 {
848 // int bytesRead;
849 uint size = sizeof(long);
850 byte[] bitData = new byte[size];
851 using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
852 {
853 bitData = mem.Read(0, (int)size);
854 }
855 //if (bytesRead == 0)
856 // return false;
857 value = BitConverter.ToInt64(bitData, 0);
858 return true;
859 }
860 catch
861 {
862 value = 0x00;
863 return false;
864 }
865 }
866 #endregion
867 #endregion
868 }
869 #endregion
870 }

  ViewVC Help
Powered by ViewVC 1.1.22